US Cybersecurity Briefing – Tuesday, Oct 27, 2026

Nothing new to report.

On Monday, UNM Hospital diverted patients to other area hospitals and canceled all appointments and outpatient surgeries at its more than 30 clinics after a “cybersecurity threat targeted the hospital's computer system.” UNM runs the state's only Level I trauma center, and Presbyterian and Lovelace took the overflow. Employees reported on-screen messages claiming student, employee and patient data had been stolen. Those claims are unverified. Admissions were limited from 12:30 to 2:30 p.m. while the network was rebooted, and phased restoration began around 2:30 p.m. Health Sciences classes were canceled Oct 26 and 27. The FBI says it is “assisting.” The attack type, threat actor and any ransom demand have not been disclosed.

Albuquerque Journal →    SecurityWeek (AP) →

UH confirmed Monday that last week's disruption, which began when it disconnected systems from the internet after suspected unusual server activity, was a cybersecurity incident. Some appointments and elective procedures have been rescheduled. MyChart remains unavailable at some locations, and pre-authorizations are affected. UH is working with outside experts and law enforcement and has given no restoration date. Whether ransomware was involved or data was taken has not been disclosed.

Cleveland 19 News →

The contact-center software vendor says attackers accessed internal business systems, including a learning management system and a CRM environment, and likely downloaded customer and prospect relationship data: names, phone numbers, business emails, job titles and account details. Genesys says the Genesys Cloud, Engage and Engage Cloud platforms and the customer data stored in them were not accessed. It declared the incident contained on Oct 23. A newly emerged group, ScarlettGroup, has claimed the attack, which Genesys has not confirmed. The number of people affected has not been disclosed.

Action: Genesys customers should expect phishing that impersonates Genesys. The company says it will never ask for passwords by email.

SecurityWeek →

The attack was discovered Oct 22, and district officials confirmed it was ransomware. Buildings were closed to students on Oct 23 and Oct 26, and students were expected back today. A third-party firm is assessing whether student or staff data was compromised. The threat actor, scope and any ransom demand have not been disclosed.

Hoodline →

These are two critical memory-safety flaws in PHP request handling, a memory-corruption bug and a stale/freed request-state bug, that can allow unauthenticated remote code execution. A Perplexity researcher confirmed RCE in honeypots against Apache mod_php on PHP 8.4.26, and Expel's Marcus Hutchins corroborated it. Amazon saw targeting four days before the Oct 21 patches. No victim organizations have been publicly named. Fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35. A related flaw, CVE-2026-115560, is still unpatched and exploitable only under unusual configurations.

Action: Upgrade PHP or apply your distro's backport now, and check vendor advisories rather than version strings. For CVE-2026-115560, set session.upload_progress.enabled=0.

The Hacker News →    BleepingComputer →

This is an out-of-bounds write in the Brotli decoder (versions 1.0.3–1.2.0), rated CVSS v4 9.2 by Google. Imperva demonstrated code execution on an official Node.js 24.22.0 image but has not published its exploit. Patches are out for Brotli (1.0.10, 1.1.1, 1.2.1), Python Brotli/brotlicffi, .NET 8/9/10, Visual Studio, PowerShell 7.4–7.6, Node.js, Bun, Envoy and Istio. DuckDB, Apache Arrow and p7zip are reportedly still unpatched.

Action: Patch, then restart services and rebuild container images, because running processes keep the vulnerable code.

SecurityWeek →

This is a SQL injection that lets any authenticated user, even Enterprise Read Only, gain operator rights and impersonate the superuser operator. It is vulnerable by default and has been exploited in attacks. Hosted VCO has been patched. No victims have been publicly named. The reminder is included because the federal deadline passed yesterday.

Action: Apply Arista advisory 0199 and consider blocking 74.82.197.86 and 38.54.50.151.

Security Affairs →

1. Albuquerque Journal – UNM Health System targeted by cyberattack
2. SecurityWeek (AP) – New Mexico hospital diverts patients
3. Cleveland 19 – University Hospitals still restoring MyChart
4. SecurityWeek – Genesys hack exposes customer data
5. Hoodline – Oneonta schools ransomware
6. The Hacker News – CISA confirms PHP2Shell exploitation
7. BleepingComputer – PHP2Shell exploited in the wild
8. SecurityWeek – Node2Shell Brotli flaw
9. Security Affairs – Arista VeloCloud flaw added to KEV